I85PREP
⌘ K
OSDA study materials
OSDA study resources

OSDA practice questions

One question at a time. Build your OSDA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Foundations of SOC Operations

Which tier of the SOC model is typically responsible for initial alert triage, validation, and escalation of confirmed incidents?

  1. SOC manager
  2. Tier 3
  3. Tier 1 Correct answer.
  4. Tier 2

Explanation

Tier 1 analysts perform first-line monitoring and triage, validating whether alerts are true positives before escalating. Deeper investigation and threat hunting sit with higher tiers, and management handles process and reporting rather than routine triage.

Question 2Foundations of SOC Operations

In the incident response lifecycle, which phase immediately follows detection and analysis?

  1. Lessons learned review
  2. Preparation
  3. Containment, eradication, and recovery Correct answer.
  4. Post-incident activity

Explanation

After an incident is detected and analyzed, the response moves into containment, eradication, and recovery to limit damage and restore normal operations. Preparation precedes detection, and post-incident activity comes after recovery is complete.

Question 3Foundations of SOC Operations

A SOC analyst receives an alert for a possible malware infection and needs to determine whether the alert is a true positive. What is this activity called?

  1. Vulnerability scanning
  2. Penetration testing
  3. Threat hunting
  4. Alert triage Correct answer.

Explanation

Alert triage is the process of reviewing, validating, and prioritizing alerts to decide whether they represent real threats. Threat hunting is proactive searching without a specific alert, while scanning and penetration testing are offensive or assessment activities.

Question 4Foundations of SOC Operations

Which metric best measures how quickly a SOC detects an incident after it actually begins?

  1. False positive rate
  2. Mean time to detect (MTTD) Correct answer.
  3. Mean time to respond (MTTR)
  4. Alert volume per analyst

Explanation

MTTD measures the elapsed time between an incident's true onset and its detection, directly reflecting detection capability. MTTR covers response duration, while alert volume and false positive rate describe workload and quality but not detection speed.

Question 5Foundations of SOC Operations

Which log source would best help an analyst determine which user account authenticated to a Windows host and when?

  1. Windows Security event logs Correct answer.
  2. Web proxy logs
  3. Firewall traffic logs
  4. DNS query logs

Explanation

Windows Security event logs record authentication events such as logons with associated account names and timestamps. Firewall, DNS, and proxy logs show network activity but do not directly attribute logon events to accounts on the host.

Question 6Foundations of SOC Operations

What is the primary purpose of a SIEM platform in SOC operations?

  1. Preventing malware execution on endpoints
  2. Aggregating and correlating logs to generate security alerts Correct answer.
  3. Managing user password resets
  4. Encrypting data at rest across servers

Explanation

A SIEM collects logs from many sources, normalizes them, and applies correlation rules to surface security-relevant alerts for analysts. Endpoint prevention, encryption, and password management are handled by other controls, not by the SIEM itself.

Question 7Foundations of SOC Operations

An analyst must decide whether to escalate an alert about a single failed login. Which factor most strongly supports escalation?

  1. The account belongs to a recently onboarded employee
  2. The source IP resolves to a cloud provider
  3. The failed login occurred during business hours
  4. The failed login is one of hundreds from the same source against many accounts Correct answer.

Explanation

A high volume of failed logins from one source across many accounts indicates a likely password-spraying or brute-force attempt, which warrants escalation. A single isolated failure, timing, or cloud-hosted source alone is weak evidence.

Question 8Foundations of SOC Operations

Which activity is characteristic of proactive threat hunting rather than reactive alert handling?

  1. Closing alerts that match a known benign pattern
  2. Formulating a hypothesis about attacker behavior and searching telemetry for evidence Correct answer.
  3. Waiting for the SIEM to generate an alert before investigating
  4. Escalating a confirmed intrusion to incident response

Explanation

Threat hunting starts from analyst hypotheses about adversary techniques and searches data for evidence, independent of existing alerts. Waiting for alerts, closing benign alerts, and escalating confirmed incidents are reactive workflows.

Question 9Foundations of SOC Operations

An analyst sees an alert where a workstation resolved a domain associated with command-and-control infrastructure. Which next step best follows the triage principle of validating before escalating?

  1. Check whether the resolution succeeded and whether the host made subsequent outbound connections to that IP Correct answer.
  2. Immediately block the domain and close the alert as resolved
  3. Disable the workstation's network adapter without further review
  4. Delete the DNS log entry to prevent false alarms

Explanation

Validation requires confirming that the suspicious lookup actually led to contact with malicious infrastructure, which strengthens or weakens the case before escalation. Blocking and closing, disabling the host, or deleting evidence skip analysis and can cause harm or lose data.

Question 10Foundations of SOC Operations

What does the MITRE ATT&CK framework primarily provide to SOC teams?

  1. A catalog of software vulnerabilities with CVSS scores
  2. A protocol for encrypting SIEM log transport
  3. A knowledge base of adversary tactics and techniques observed in real intrusions Correct answer.
  4. A set of regulatory compliance controls for financial institutions

Explanation

ATT&CK organizes observed adversary behavior into tactics and techniques, helping SOC teams map detections and prioritize coverage. Vulnerability catalogs, compliance frameworks, and transport protocols are different resources entirely.

Question 11Foundations of SOC Operations

Which indicator is most directly associated with a ransomware infection on a file server?

  1. A single failed login from an internal address
  2. A scheduled backup completing on time
  3. A rapid spike in file rename operations with unusual extensions Correct answer.
  4. A gradual increase in outbound DNS query volume

Explanation

Ransomware typically encrypts files, producing mass rename or write operations and appended extensions, which is a strong host-level indicator. DNS volume changes, isolated failed logins, and successful backups do not indicate encryption activity.

Question 12Foundations of SOC Operations

In the context of SOC operations, what distinguishes an event from an incident?

  1. An event is always more severe than an incident
  2. An incident is a false positive that has been closed
  3. An incident is any log entry generated by a security device
  4. An incident is an event or series of events that negatively affects or threatens confidentiality, integrity, or availability Correct answer.

Explanation

An event is any observable occurrence in a system, while an incident is an event or series of events with actual or threatened negative impact on security objectives. Not every log entry is an incident, and severity does not make an event inherently greater than an incident.

Question 13Foundations of SOC Operations

Which practice best supports evidence integrity when an analyst collects volatile data from a compromised host?

  1. Documenting the collection with timestamps and preserving a hash of the acquired data Correct answer.
  2. Rebooting the host first to clear malicious processes
  3. Copying only files the analyst believes are relevant
  4. Storing collected data on the compromised host's own disk

Explanation

Maintaining a documented chain of custody with timestamps and cryptographic hashes preserves evidence integrity and admissibility. Rebooting destroys volatile data, selective copying risks losing evidence, and storing data on the compromised host exposes it to tampering.

Question 14Foundations of SOC Operations

A SOC wants to reduce alert fatigue. Which change most directly addresses the root cause of excessive low-value alerts?

  1. Hiring more Tier 1 analysts to process every alert
  2. Tuning detection rules to suppress known benign patterns and raising fidelity Correct answer.
  3. Increasing the alert retention period in the SIEM
  4. Adding more log sources without adjusting rules

Explanation

Alert fatigue stems from high volumes of low-fidelity alerts, so tuning rules and suppressing known benign patterns improves signal quality. Adding staff or retention does not reduce volume, and adding sources without tuning worsens the problem.

Question 15Foundations of SOC Operations

Which control type is a security awareness training program for employees?

  1. Preventive hardware control
  2. Physical control
  3. Technical control
  4. Administrative control Correct answer.

Explanation

Security awareness training is an administrative (management) control because it shapes policies and human behavior rather than enforcing technical restrictions. Technical controls are implemented in systems, and physical controls restrict access to facilities.

Question 16Foundations of SOC Operations

An analyst observes a workstation making periodic HTTPS connections to an unknown external IP at consistent 60-second intervals with small payloads. Which hypothesis is most reasonable to investigate first?

  1. A scheduled software update from a trusted vendor
  2. A routine DNS cache refresh
  3. A user browsing social media during a break
  4. Beaconing consistent with command-and-control communication Correct answer.

Explanation

Regular, fixed-interval small outbound connections are a classic beaconing pattern associated with command-and-control channels. Vendor updates are usually verified by domain reputation, and browsing or DNS refresh do not typically produce such rigid periodicity to an unknown IP.

Question 17Foundations of SOC Operations

Which approach best aligns SOC detection engineering with the organization's actual risk posture?

  1. Relying solely on vendor default rules without customization
  2. Focusing exclusively on the highest-volume alert sources
  3. Prioritizing detection coverage for techniques mapped to the organization's most critical assets and threat profile Correct answer.
  4. Deploying every publicly available detection rule regardless of environment

Explanation

Effective detection engineering maps coverage to prioritized threats and critical assets, ensuring effort targets relevant risk. Blanket deployment of all rules, volume-based focus, or unmodified vendor defaults creates noise and gaps rather than aligned coverage.

Question 18Foundations of SOC Operations

A SOC receives an intelligence report describing a new malware family's indicators. Which action best reflects operationalizing threat intelligence?

  1. Encoding the indicators into detection rules and validating them against historical telemetry Correct answer.
  2. Waiting for the malware to appear before taking any action
  3. Forwarding the report to executives without technical action
  4. Filing the report in a shared folder for future reference

Explanation

Operationalizing intelligence means converting indicators into actionable detections and testing them against existing data to confirm they work. Filing, forwarding, or waiting passively does not translate intelligence into defensive capability.

Question 19Foundations of SOC Operations

During an incident, an analyst must choose between isolating a host and continuing monitoring. Which consideration most strongly justifies immediate isolation?

  1. Evidence indicates active lateral movement from the host to other systems Correct answer.
  2. The host has not received patches in 30 days
  3. The host belongs to a senior executive
  4. The host's antivirus signature database is one day old

Explanation

Active lateral movement means the compromise is spreading, so containment to prevent further damage outweighs the cost of continued monitoring. Executive ownership, patch lag, or slightly stale signatures are risk factors but not evidence of ongoing spread.

Question 20Foundations of SOC Operations

Which statement correctly describes the relationship between a playbook and a runbook in SOC operations?

  1. A playbook defines the overall response strategy for an incident type, while a runbook gives step-by-step operational procedures Correct answer.
  2. A playbook is used only for threat hunting, never for incidents
  3. A runbook defines strategy, while a playbook lists tool licenses
  4. A playbook and a runbook are identical in scope and purpose

Explanation

Playbooks describe the strategic approach and decision points for handling an incident type, whereas runbooks provide detailed, repeatable procedural steps for executing tasks. They differ in scope and are both used in incident response.

Question 21Foundations of SOC Operations

What is the main benefit of establishing a baseline of normal network behavior for a SOC?

  1. It replaces the need for incident response plans
  2. It guarantees that no intrusions will occur
  3. It eliminates the need for log collection
  4. It enables detection of anomalies that deviate from expected patterns Correct answer.

Explanation

Baselines characterize normal traffic and activity so deviations can be flagged as potential threats. Baselines do not remove the need for logging, prevent intrusions, or substitute for response planning.

Question 22Foundations of SOC Operations

An alert fires for a user accessing a large number of files outside their normal working hours. Which additional context most strengthens the case for escalation?

  1. The access occurred on a weekday
  2. The user's account recently changed departments and the access pattern matches a known exfiltration tool signature Correct answer.
  3. The files are stored on a shared network drive
  4. The user has been employed for many years

Explanation

Combining an abnormal access pattern with a tool signature consistent with exfiltration materially raises the likelihood of malicious activity. Long tenure, shared storage location, and weekday timing are neutral or weakly relevant details.

Question 23Foundations of SOC Operations

Which element is essential to a defensible chain of custody record?

  1. Who handled the evidence, when, and what was done at each transfer Correct answer.
  2. The marketing impact of the breach
  3. The analyst's opinion about the suspect's motive
  4. The estimated financial loss from the incident

Explanation

Chain of custody documents each handler, timestamp, and action to prove evidence was not altered. Motive opinions, financial estimates, and marketing impact are not part of custody documentation.

Question 24Foundations of SOC Operations

Why should a SOC define severity levels for alerts?

  1. To ensure every alert is investigated with equal effort
  2. To reduce the number of log sources collected
  3. To prioritize response effort so the most impactful threats are handled first Correct answer.
  4. To avoid documenting triage decisions

Explanation

Severity levels let analysts allocate limited resources to the most impactful threats first. Equal effort across all alerts is inefficient, and severity does not reduce log collection or remove documentation requirements.

Question 25Foundations of SOC Operations

Which source would an analyst consult to learn what a specific ATT&CK technique looks like in telemetry and how to detect it?

  1. The IT asset inventory spreadsheet
  2. A firewall vendor's licensing agreement
  3. ATT&CK technique pages with detection guidance and data sources Correct answer.
  4. The organization's acceptable use policy

Explanation

ATT&CK technique pages describe adversary behavior, relevant data sources, and detection considerations, making them useful for detection mapping. Policies, license agreements, and asset inventories do not describe adversary techniques.

Question 26Foundations of SOC Operations

A SOC analyst triages an alert and confirms it is a true positive that requires coordinated response across several teams. Which term best describes this alert once triage confirms it meets the criteria for a formal, tracked response?

  1. A vulnerability scan result
  2. An incident Correct answer.
  3. A benign event
  4. A configuration baseline deviation

Explanation

An incident is an event that has been validated as having actual or potential negative impact and therefore warrants a coordinated, tracked response. Triage is the step that promotes a suspicious event to incident status when the criteria are met.

Question 27Foundations of SOC Operations

A SOC is defining tiered responsibilities. Which task set is most characteristic of a Tier 1 analyst role?

  1. Setting the organization's overall cyber risk appetite and budget
  2. Designing detection rules and tuning correlation logic across data sources
  3. Leading containment and eradication for major multi-host intrusions
  4. Monitoring the alert queue, performing initial triage, and escalating confirmed incidents Correct answer.

Explanation

Tier 1 is the first line of monitoring and triage, filtering alerts and escalating those that need deeper work. Detection engineering and major incident command sit at higher tiers, and risk appetite is an executive governance decision.

Question 28Foundations of SOC Operations

Which metric best measures how quickly a SOC moves a validated incident from detection to containment initiation?

  1. Number of detection rules deployed
  2. Mean time to respond (MTTR) Correct answer.
  3. Alert volume per sensor per day
  4. Percentage of endpoints with an agent installed

Explanation

MTTR captures the elapsed time from detection to response action, reflecting how fast the SOC acts on validated incidents. The other metrics describe workload, detection coverage, or deployment completeness rather than response speed.

Question 29Foundations of SOC Operations

A SOC analyst receives an alert on a workstation and needs to determine whether the activity is malicious. Which action best reflects the core analytic discipline of correlating evidence before concluding?

  1. Waiting for the user to report a problem before investigating
  2. Pivoting across endpoint, identity, and network telemetry to build a consistent picture of the activity Correct answer.
  3. Closing the alert because the endpoint antivirus did not flag the file
  4. Escalating immediately without reviewing any telemetry to save time

Explanation

Sound triage correlates multiple independent telemetry sources so the conclusion rests on converging evidence rather than a single signal. Relying on one control's silence or on user reports alone leaves blind spots and delays detection.

Question 30Foundations of SOC Operations

An analyst must decide where a piece of evidence fits in the order of volatility. Which item should be collected first because it is most likely to be lost?

  1. Files archived on a backup server
  2. Contents of RAM on the running host Correct answer.
  3. Log entries already forwarded to the SIEM
  4. Disk image of the system volume

Explanation

The order of volatility prioritizes data that disappears fastest, and volatile memory on a running system is lost on shutdown or reboot. Forwarded logs, backups, and disk images persist longer and can be collected afterward.

Question 31Foundations of SOC Operations

A SOC wants to describe adversary behavior in a consistent, comparable way across teams and tools. Which framework organizes observed activity into tactics and techniques mapped to real-world adversary use?

  1. The CVSS scoring rubric
  2. The NIST Cybersecurity Framework core functions
  3. The PCI DSS control list
  4. MITRE ATT&CK Correct answer.

Explanation

MITRE ATT&CK catalogs adversary tactics and techniques based on observed behavior, giving SOC teams a shared vocabulary for detection and reporting. The other frameworks address compliance controls, program maturity, or vulnerability severity rather than behavioral technique mapping.

Question 32Foundations of SOC Operations

A SOC analyst is preparing an intelligence-driven detection. Which characteristic most distinguishes tactical threat intelligence from strategic threat intelligence?

  1. Tactical intelligence focuses on long-term geopolitical risk trends affecting the business
  2. Tactical intelligence describes only the legal implications of a breach
  3. Tactical intelligence focuses on operational indicators and adversary behaviors usable in detection content Correct answer.
  4. Tactical intelligence is produced only by executive leadership for budget planning

Explanation

Tactical threat intelligence covers operational details such as indicators, tooling, and techniques that feed detection rules and hunting. Strategic intelligence addresses higher-level trends and risk to inform leadership decisions.

Question 33Foundations of SOC Operations

An analyst sees a host beaconing to an external address at regular intervals with jittered timing and small encrypted payloads. Which hypothesis should the analyst test first?

  1. The host is communicating with command-and-control infrastructure Correct answer.
  2. The host is performing a routine operating system update
  3. The host is serving as a legitimate time synchronization client
  4. The host is running an authorized vulnerability scan

Explanation

Periodic jittered beaconing with small encrypted payloads is a classic command-and-control pattern used to blend in and maintain persistence. Checking process lineage, destination reputation, and whether the traffic matches approved software helps confirm or refute this hypothesis.

Question 34Foundations of SOC Operations

A SOC wants to reduce noisy, low-fidelity alerts at their source. Which action most directly improves detection quality rather than merely hiding the symptom?

  1. Disabling alerts for entire log sources that generate noise
  2. Increasing the alert queue size handled per analyst shift
  3. Tuning detection logic with contextual enrichment and validated thresholds Correct answer.
  4. Routing all alerts directly to senior management

Explanation

Root-cause improvement comes from refining detection logic with context and validated thresholds so alerts reflect genuine risk. Suppressing whole sources or shifting workload elsewhere hides the problem without improving fidelity.

Question 35Foundations of SOC Operations

An analyst is documenting an investigation and must record how a suspicious binary was identified. Which practice best supports reproducibility of the analysis?

  1. Storing only a screenshot of the file name in a chat channel
  2. Summarizing the finding from memory at the end of the shift
  3. Relying on the original analyst's recollection during handover
  4. Recording the hashes, collection times, and query logic used to identify the file Correct answer.

Explanation

Reproducibility requires documenting hashes, timestamps, and the exact queries so another analyst can verify the same result. Informal screenshots or memory-based summaries cannot be independently validated.

Question 36Foundations of SOC Operations

During an intrusion, an analyst must decide whether to isolate a host immediately or continue monitoring to gather more intelligence. Which consideration should weigh most heavily in favor of immediate isolation?

  1. The possibility that the host might later show additional alerts
  2. A desire to capture the full attack sequence for a future report
  3. Evidence that the adversary is actively moving laterally to high-value systems Correct answer.
  4. The convenience of finishing the current shift without handover

Explanation

Active lateral movement toward high-value assets raises potential impact and justifies containment before further spread. Intelligence value matters, but it should not override the need to stop ongoing damage.

Question 37Foundations of SOC Operations

A SOC receives a report of a new malware family with file hashes and network indicators. Which action best reflects operationalizing that intelligence within the SOC?

  1. Adding the report to the annual audit evidence package
  2. Forwarding the report to all employees as a warning email
  3. Filing the report in a shared folder for later reference
  4. Converting the indicators into validated detection queries and hunting hypotheses Correct answer.

Explanation

Operationalizing intelligence means turning it into actionable detection content and hunting hypotheses that the SOC can execute against its telemetry. Passive filing or broad distribution does not create detection capability.

Question 38Foundations of SOC Operations

An analyst is asked to explain why an alert was closed as benign. Which justification is analytically sound?

  1. The alert came from a tool the team generally trusts
  2. The user said nothing was wrong when asked
  3. The alert did not repeat within the next hour
  4. The process was confirmed as a signed corporate update client, verified by hash and parent process Correct answer.

Explanation

A sound closure justification rests on verifiable evidence such as a signed binary, matching hash, and expected parent process. Trust assumptions, user reassurance, or absence of recurrence are weak and do not establish benignity.

Question 39Foundations of SOC Operations

A SOC observes that a detection rule fires almost exclusively for a legacy application that is being decommissioned next quarter. Which response best balances risk and operational cost while the application remains in service?

  1. Delete the rule entirely so the queue stays clean
  2. Leave the rule unchanged and accept the recurring noise
  3. Add a scoped suppression with a review date tied to decommissioning and monitor for abuse of that exception Correct answer.
  4. Disable the legacy application's logging to reduce events

Explanation

A scoped, time-bound suppression tied to decommissioning preserves detection for genuine abuse while removing known benign noise. Deleting the rule or disabling logging would remove visibility, and accepting noise indefinitely wastes analyst capacity.

Question 40Foundations of SOC Operations

A SOC is evaluating whether its monitoring covers the tactics most relevant to its threat model. Which approach best tests coverage in a measurable, repeatable way?

  1. Reviewing the number of tickets closed per month
  2. Surveying analysts about which alerts they find interesting
  3. Counting the total number of rules in the SIEM
  4. Running controlled adversary emulation mapped to ATT&CK techniques and recording which detections fired Correct answer.

Explanation

Adversary emulation mapped to ATT&CK techniques produces measurable evidence of which behaviors are detected and which are missed. Rule counts, analyst preference, and ticket volume do not demonstrate coverage of relevant tactics.

Question 41Threat Detection and Analysis

During triage, an analyst observes a Windows process whose parent is winword.exe and whose command line includes 'powershell -nop -w hidden -enc'. Which ATT&CK technique best describes this behavior?

  1. Command and Scripting Interpreter: PowerShell (T1059.001) Correct answer.
  2. OS Credential Dumping (T1003)
  3. Data Encrypted for Impact (T1486)
  4. Phishing (T1566)

Explanation

The parent-child relationship of an Office application spawning PowerShell with hidden window, no-profile, and encoded-command flags is a canonical execution pattern. ATT&CK maps this to T1059.001 Command and Scripting Interpreter: PowerShell, which covers malicious interpreter use. Phishing describes the delivery vector, not the observed execution behavior.

Question 42Threat Detection and Analysis

An IDS rule fires on HTTP traffic containing the string '../../../../etc/passwd'. Which attack class does this signature most directly detect?

  1. Cross-site scripting
  2. Directory traversal Correct answer.
  3. Command injection
  4. SQL injection

Explanation

Sequences of '../' are used to escape the web root and reach files outside the intended directory, which is directory traversal. The target path /etc/passwd further indicates an attempt to read a sensitive system file. SQL injection and XSS payloads manipulate query syntax or browser-side script rather than relative path segments.

Question 43Threat Detection and Analysis

Which log source is most appropriate for detecting a successful remote SMB authentication to a Windows file server?

  1. Windows Security event ID 1102
  2. Sysmon event ID 1
  3. Windows Security event ID 4624 with logon type 3 Correct answer.
  4. Windows Security event ID 4688

Explanation

Event ID 4624 records successful logons, and logon type 3 indicates a network logon such as SMB access to a share. This makes it the primary source for confirming remote authentication success. Event 4688 records process creation, Sysmon ID 1 records process creation with richer detail, and 1102 records log clearing.

Question 44Threat Detection and Analysis

A SIEM alert shows outbound DNS queries to randomly generated subdomains of a single parent domain at a steady rate. Which technique is most consistent with this pattern?

  1. DNS tunneling for exfiltration Correct answer.
  2. Fast flux hosting
  3. Typosquatting
  4. Domain fronting

Explanation

High-volume queries to many unique, random-looking subdomains of one parent domain are characteristic of DNS tunneling, where data is encoded in query names. The steady cadence supports an automated channel rather than user browsing. Domain fronting, fast flux, and typosquatting describe different abuse patterns.

Question 45Threat Detection and Analysis

In the Cyber Kill Chain, which phase immediately follows 'Weaponization'?

  1. Reconnaissance
  2. Exploitation
  3. Command and Control
  4. Delivery Correct answer.

Explanation

The kill chain proceeds Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. Delivery is the phase in which the weaponized payload is transmitted to the target.

Question 46Threat Detection and Analysis

An analyst needs to determine whether a suspicious binary was signed by a trusted publisher. Which artifact provides the most direct evidence?

  1. The file's entropy score
  2. The Authenticode signature embedded in the PE certificate table Correct answer.
  3. The file's PE timestamp
  4. The NTFS creation timestamp

Explanation

Authenticode signatures are stored in the PE certificate table and can be validated against a trusted certificate chain. This directly answers whether the publisher is trusted. Timestamps and entropy provide context but do not establish signer identity.

Question 47Threat Detection and Analysis

What is the primary purpose of the Diamond Model in intrusion analysis?

  1. To sequence detection rules by MITRE ATT&CK tactic
  2. To classify malware by file entropy
  3. To rank vulnerabilities by CVSS severity
  4. To describe an intrusion through adversary, capability, infrastructure, and victim Correct answer.

Explanation

The Diamond Model represents every intrusion event as the relationship among four core features: adversary, capability, infrastructure, and victim. Analysts use these vertices to pivot and build hypotheses. It is not a vulnerability scoring or rule-sequencing framework.

Question 48Threat Detection and Analysis

A user reports that their browser homepage changed and new extensions appeared after installing a free utility. Which detection focus best fits this scenario?

  1. Potentially unwanted program behavior affecting browser configuration Correct answer.
  2. Ransomware encryption of user documents
  3. Lateral movement over SMB
  4. Credential dumping from LSASS

Explanation

Bundled browser modifications such as homepage changes and unexpected extensions are typical of potentially unwanted programs. The symptoms are configuration changes rather than data encryption or credential theft. This makes PUP behavior the most fitting detection focus.

Question 49Threat Detection and Analysis

An analyst sees Sysmon event ID 8 with a target process of lsass.exe. Which activity should be investigated?

  1. Creation of a remote thread inside LSASS, possibly credential access Correct answer.
  2. A scheduled task being registered
  3. A DNS query made by the process
  4. A new service being installed

Explanation

Sysmon event ID 8 records CreateRemoteThread, and a target of lsass.exe suggests code injection into the credential store. This is a common precursor to credential dumping. Service and scheduled-task events use different IDs, and DNS queries are logged under event ID 22.

Question 50Threat Detection and Analysis

A proxy log shows repeated POST requests to a single external IP address with consistent multipart bodies of roughly 2 MB each, occurring outside business hours. Which hypothesis is most supported?

  1. Data exfiltration over HTTP Correct answer.
  2. Port scanning
  3. DNS beaconing
  4. Web shell command execution

Explanation

Large, regular outbound POST bodies to one external host outside normal hours are consistent with staged data being exfiltrated over HTTP. The consistent size and timing indicate automation. Web shells, DNS beaconing, and scanning have different observable signatures.